Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by GitHub_M

CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loop

High 7.1

In plain English

A high-severity infinite loop in Pillow from python-pillow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pillowno fix listedDEBIAN-CVE-2026-96642
Debian:13pillowno fix listedDEBIAN-CVE-2026-96642
Debian:14pillowno fix listedDEBIAN-CVE-2026-96642
PyPIpillow13.0.0GHSA-3j72-p6qg-6xp7
PyPIpillow13.0.0PYSEC-2026-4341
Ubuntu:22.04:LTSpillowno fix listedUBUNTU-CVE-2026-96642
Ubuntu:24.04:LTSpillowno fix listedUBUNTU-CVE-2026-96642
Ubuntu:26.04:LTSpillowno fix listedUBUNTU-CVE-2026-96642
Ubuntu:26.10pillowno fix listedUBUNTU-CVE-2026-96642

Affected products (as reported)

VendorProductVersions
python-pillow Pillow < 13.0.0

Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References